Bulz.284902 (B) (file analysis)

The Bulz.284902 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.284902 (B) virus can do?

• Injection (inter-process)
• Injection (Process Hollowing)
• Injection with CreateRemoteThread in a remote process
• Creates RWX memory
• Reads data out of its own binary image
• A process created a hidden window
• Drops a binary and executes it
• Executed a process and injected code into it, probably while unpacking
• Sniffs keystrokes
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Interacts with known DarkComet registry keys
• Creates known Fynloski/DarkComet mutexes

Related domains:

How to determine Bulz.284902 (B)?

File Info:
crc32: BBC94BE1
md5: b7ea0a82e1d5b97e04e937db8d53c534
name: B7EA0A82E1D5B97E04E937DB8D53C534.mlw
sha1: 9b4497b5ab0ee954aaf7253622eb709310f26267
sha256: 80c69b997fd06c163790c558ab21ace6d3b04eea1664f97746da10b5de799c29
sha512: 32272439f6a27f4d65bc5be3a75050a63bd3ef9a7f0e2beb6559683d702e30fbad6869daca1cb005263cb7f1a9b57492faf3f24625030721e5c80e958d1245fb
ssdeep: 24576:q2G/nvxW3WwWi81yqUsNuS+jOVdbScqVeW:qbA3K/1RUIT+j4bSd
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Bulz.284902 (B) also known as:

How to remove Bulz.284902 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.